Apple QuickTime Multiple Integer and Buffer Overflow Vulnerabilities

Bugtraq ID:	17953
Class:	Boundary Condition Error
CVE:	CVE-2006-1458 CVE-2006-1459 CVE-2006-1460 CVE-2006-1461 CVE-2006-1462 CVE-2006-1463 CVE-2006-1464 CVE-2006-1465 CVE-2006-1453 CVE-2006-1454 CVE-2006-2238
Remote:	Yes
Local:	No
Published:	May 11 2006 12:00AM
Updated:	May 15 2006 10:29PM
Credit:	The vendor credits Mike Price of McAfee Avert Labs, ATmaCA working through TippingPoint, eEye Digital Security, and the Zero Day Initiative for the discovery of these vulnerabilities.
Vulnerable:	Apple QuickTime Player 7.0.4 Apple QuickTime Player 7.0.3 Apple QuickTime Player 7.0.2 Apple QuickTime Player 7.0.1 Apple QuickTime Player 7.0 Apple QuickTime Player 6.5.2 Apple QuickTime Player 6.5.1 Apple QuickTime Player 6.5 Apple QuickTime Player 6.1 Apple QuickTime Player 6 - Apple Mac OS 9 9.2.2 - Apple Mac OS 9 9.2.2 - Apple Mac OS 9 9.2.1 - Apple Mac OS 9 9.2.1 - Apple Mac OS 9 9.2 - Apple Mac OS 9 9.2 - Apple Mac OS 9 9.1 - Apple Mac OS 9 9.1 - Apple Mac OS 9 9.0.4 - Apple Mac OS 9 9.0.4 - Apple Mac OS 9 9.0 - Apple Mac OS 9 9.0 - Apple Mac OS X 10.1.5 - Apple Mac OS X 10.1.4 - Apple Mac OS X 10.1.4 - Apple Mac OS X 10.1.3 - Apple Mac OS X 10.1.3 - Apple Mac OS X 10.1.2 - Apple Mac OS X 10.1.2 - Apple Mac OS X 10.1.1 - Apple Mac OS X 10.1.1 - Apple Mac OS X 10.1 - Apple Mac OS X 10.1 - Apple Mac OS X 10.1 - Apple Mac OS X 10.1 - Apple Mac OS X 10.0.4 - Apple Mac OS X 10.0.4 - Apple Mac OS X 10.0.3 - Apple Mac OS X 10.0.3 - Apple Mac OS X 10.0.2 - Apple Mac OS X 10.0.2 - Apple Mac OS X 10.0.1 - Apple Mac OS X 10.0.1 - Apple Mac OS X 10.0 - Apple Mac OS X 10.0 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows 2000 Server - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services - Microsoft Windows 2000 Terminal Services - Microsoft Windows 95 SR2 - Microsoft Windows 95 SR2 - Microsoft Windows 95 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows ME - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Terminal Server 4.0 SP6a - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP5 - Microsoft Windows NT Terminal Server 4.0 SP5 - Microsoft Windows NT Terminal Server 4.0 SP4 - Microsoft Windows NT Terminal Server 4.0 SP4 - Microsoft Windows NT Terminal Server 4.0 SP3 - Microsoft Windows NT Terminal Server 4.0 SP3 - Microsoft Windows NT Terminal Server 4.0 SP2 - Microsoft Windows NT Terminal Server 4.0 SP2 - Microsoft Windows NT Terminal Server 4.0 SP1 - Microsoft Windows NT Terminal Server 4.0 SP1 - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows NT Workstation 4.0
Not Vulnerable:	Apple QuickTime Player 7.1

Apple QuickTime Multiple Integer and Buffer Overflow Vulnerabilities

Multiple integer-overflow and buffer-overflow vulnerabilities affect QuickTime. These issues affect both Mac OS X and Microsoft Windows releases of the software.

Successful exploits will result in the execution of arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely cause denial-of-service conditions.

Apple QuickTime Multiple Integer and Buffer Overflow Vulnerabilities

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

Apple QuickTime Multiple Integer and Buffer Overflow Vulnerabilities

Solution:
The vendor has released QuickTime version 7.1 to address these issues.


Apple QuickTime Player 6.1

• Apple QuickTime 7.1
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=09374&cat= 1&platform=osx&method=sa/mac.html

Apple QuickTime Player 6.5

• Apple QuickTime 7.1
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=09374&cat= 1&platform=osx&method=sa/mac.html

Apple QuickTime Player 6.5.1

• Apple QuickTime 7.1
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=09374&cat= 1&platform=osx&method=sa/mac.html

Apple QuickTime Player 6.5.2

• Apple QuickTime 7.1
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=09374&cat= 1&platform=osx&method=sa/mac.html

Apple QuickTime Player 7.0

• Apple QuickTime 7.1
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=09374&cat= 1&platform=osx&method=sa/mac.html

Apple QuickTime Player 7.0.1

• Apple QuickTime 7.1
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=09374&cat= 1&platform=osx&method=sa/mac.html

Apple QuickTime Player 7.0.2

• Apple QuickTime 7.1
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=09374&cat= 1&platform=osx&method=sa/mac.html

Apple QuickTime Player 7.0.3

• Apple QuickTime 7.1
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=09374&cat= 1&platform=osx&method=sa/mac.html

Apple QuickTime Player 7.0.4

• Apple QuickTime 7.1
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=09374&cat= 1&platform=osx&method=sa/mac.html

Apple QuickTime Multiple Integer and Buffer Overflow Vulnerabilities

References:

• About the security content of the QuickTime 7.1 Update (Apple)
  
• Apple QuickTime Homepage (Apple)
  
• [EEYEB-20060307] Apple QuickTime FPX Integer Overflow (eEye Advisories )
  
• Apple QuickTime udta ATOM Heap Overflow (Sowhat )
  
• ZDI-06-015: Apple QuickTime H.264 Parsing Heap Overflow Vulnerability ([email protected])